Graylog Regex Extractors for WatchGuard Logs

WatchGuardGraylogExtractors.txt

protocol:
(tcp|udp)

srcIP:
(?:tcp|udp)\s(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})

dstIP:
(?:\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\s(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}))

insideInterface:
((\d{1,2}-([A-Z]|[a-z])[a-z]*))

DestCountry:
(?:geo_dst="(\w{1,99})")

category:
(?:cats="(\w{1,99})")

AppName:
(?:app_name="((\w{1,99})(\s)?(\w{1,99})?))"

destinationSiteName:
(?:dstname="(\w{1,99}.\w{1,99}.\w{1,99})")
-- This one also has a Key=Value converter

# The order for these matters
dst_port:
(\d{1,99})(?:\smsg)

dst_port:
(\d{1,99})(?:\sapp_id)

dst_port:
(\d{1,99})(?:\sapp_name)

dst_port:
(\d{1,99})(?:\soffset)

SNI:
(?:sni="(.*?)")